[co-author: Hilary Higgins]
Several comprehensive privacy bills are being considered at the state level. This blog post provides notable updates on bills companies should be paying attention to as they move through their respective legislatures. We will continue to keep you posted on updates to these bills and others as they occur.
Since our last update, there has been significant movement on the bills we have been tracking. Utah is currently on track to become the fourth state to have a comprehensive privacy law, joining California, Colorado, and Virginia (assuming the bill makes it through reconciliation and is signed into law by the governor). If signed into law, the bill would go into effect on December 31, 2023. Like Virginia and Colorado, the Utah bill does not create any private right of action for consumers. It’s unclear whether any other state will join Utah in passing a privacy law this legislative session or if four (or more states) having their own privacy laws will inspire Congress enough to pass federal privacy legislation.
Utah Privacy Bill Passes Senate and House: Utah’s Consumer Privacy Act (SB 227) passed the Utah Senate on February 25 unanimously. The Bill then passed the House on March 2, also unanimously. The Bill applies to controllers or processors that do business in the state, or produce a product or service that is targeted to consumers who are Utah residents, have annual revenue of $25M or more; and either a) control or process personal data of 100,000 or more consumers during a calendar year; or b) derive over 50% of the entity's gross revenue from the sale of personal data and control or process the personal data of 25,000 or more consumers. The Bill does not provide a private right of action for consumers, instead providing the Attorney General exclusive authority to enforce. A thirty-day cure period is provided for in the Act.
Wisconsin’s Data Privacy Act Passes Assembly: The Wisconsin Assembly voted to pass Wisconsin’s Data Privacy Act (Assembly Bill 957) on February 23 by a vote of 59 to 37. The Bill now moves to the Senate, where it has been referred to the committee on Government Operations, Legal Review, and Consumer Protection. The Act applies to controllers that, alone or with others, determine the purpose and means of processing personal data, and that either a) process the personal data of at least 100,000 consumers or b) control or process the personal data of at least 25,000 consumers and derive over 50 percent of their gross revenue from the sale of personal data. This Act does not create a private right of action, and it creates a thirty-day cure period. If passed, the Bill would go into effect on January 1, 2024.
Florida Privacy Bill Passes House: Florida’s Consumer Data Privacy Bill (HB 9) was passed by the Florida House on March 2 with a vote of 103 to 8. The Bill now moves to the Senate, where it has been referred to the Judiciary Committee. The bill applies to “controllers” that do business in the state, collect consumers’ personal information, determine the purposes and means of processing the information, and that satisfy at least two of the following: a) have global annual revenues over $50M; b) annually buy, sell, or share the personal information of 50,000 or more consumers, households, or devices for targeted advertising with third parties (only for information bought, sold, or shared within previous 12 months); or (c) derive 50 percent or more of global annual revenues from selling or sharing consumers’ personal information. Notably, HB9 creates a private right of action for certain claims. If passed, the Bill would go into effect on January 1, 2023.
